CN115618334A

CN115618334A - Attack defense method and device, electronic equipment and storage medium

Info

Publication number: CN115618334A
Application number: CN202211272886.6A
Authority: CN
Inventors: 吕经祥; 童志明
Original assignee: Antiy Technology Group Co Ltd
Current assignee: Antiy Technology Group Co Ltd
Priority date: 2022-10-18
Filing date: 2022-10-18
Publication date: 2023-01-17

Abstract

The application provides an attack defense method, an attack defense device, electronic equipment and a storage medium, which are applied to the electronic equipment, wherein the method comprises the following steps: acquiring each key use function in the electronic equipment; the key usage function is capable of being called by a program within the electronic device to encrypt files within the electronic device using the key; adding a preset code in each key use function; the preset code can be triggered to execute when the key using function is called to record the key used by the key using function. According to the attack defense method, when the key using function is called, the preset code in the key using function can be executed, and when the preset code is executed, the key used by the key using function can be recorded. Therefore, even if the file in the electronic equipment is encrypted by the lasso software, the encrypted file can be decrypted through the recorded secret key without paying money to the lasso software, so that the defense of the lasso software is realized, and the loss caused by the lasso software is avoided.

Description

Attack defense method and device, electronic equipment and storage medium

Technical Field

The present application relates to the field of data security, and in particular, to an attack defense method and apparatus, an electronic device, and a storage medium.

Background

The lasso software is a common trojan horse, and enables user data assets or computing resources to be incapable of being normally used by harassing, scaring or even adopting a way of kidnapping user files and the like, and lassifies money to the user under the condition of the strangling. Such user data assets include documents, mail, databases, source code, pictures, compressed files, and the like.

For example, the lasso software generates a key by calling a key in a DLL (dynamic link library) in the system and calls the key to encrypt a file of a user using a function, and the user cannot normally open the corresponding file because the user does not have the key for decryption. Only after the user delivers money according to the guidance of the lasso software, the corresponding secret key can be obtained to decrypt the file.

Disclosure of Invention

In view of the above, the present application provides an attack defense method, an attack defense apparatus, an electronic device, and a storage medium, which at least partially solve the problems in the prior art.

In an aspect of the present application, an attack defense method is provided, which is applied to an electronic device, and includes:

acquiring each key use function in the electronic equipment; the key usage function is capable of being called by a program within the electronic device to encrypt a file within the electronic device using a key;

adding a preset code in each key using function; the preset code can be triggered to execute when the key using function where the preset code is located is called, so as to record the key used by the key using function.

In an exemplary embodiment of the present application, the adding of the preset code in each key usage function includes:

a preset code is added to the function entry of each key usage function.

In an exemplary embodiment of the present application, the preset code is configured to perform the steps of:

acquiring an encryption key received by the key using function;

and storing the encryption key in a preset storage space.

In an exemplary embodiment of the present application, the preset code is further configured to perform the following steps:

acquiring the file name of a target file to be encrypted by the encryption key;

and storing the file name in a preset storage space.

In an exemplary embodiment of the present application, the method further comprises:

if the preset storage space receives an encryption key returned by the key use function, establishing a record document corresponding to the encryption key;

establishing an association relation between the recording document and the encryption key; the recording document is used for recording an encryption key having an association relation with the recording document and a file name of a target file encrypted by using the encryption key.

In an exemplary embodiment of the application, if the preset storage space receives an encryption key returned by the key using function, establishing a record document corresponding to the encryption key includes:

determining whether a recording document corresponding to the encryption key exists in the preset storage space;

if yes, adding the file name corresponding to the encryption key into the record document;

if the file name does not exist, establishing a record document corresponding to the encryption key, and adding the file name corresponding to the encryption key into the record document.

and if the updating times of any record document in the preset storage space in a preset time length exceed a set threshold, outputting prompt information and/or preventing the key from being continuously called by using a function.

In another aspect of the present application, an attack defense apparatus applied to an electronic device is provided, including:

the acquisition module is used for acquiring each key use function in the electronic equipment; the key usage function is capable of being called by a program within the electronic device to encrypt a file within the electronic device using a key;

the processing module is used for adding preset codes in each key use function; the preset code can be triggered to execute when the key using function where the preset code is located is called, so as to record the key used by the key using function.

In another aspect of the present application, there is provided an electronic device comprising a processor and a memory;

the processor is configured to perform the steps of any of the above methods by calling a program or instructions stored in the memory.

In another aspect of the application, there is provided a non-transitory computer readable storage medium storing a program or instructions for causing a computer to perform the steps of any of the methods described above.

According to the attack defense method, the preset code is added to the key use function used for the key in the electronic equipment. When the key using function is called, the preset code in the key using function can be executed, and when the preset code is executed, the key generated by the key using function can be recorded. Therefore, even if the file in the electronic equipment is encrypted by the lasso software, the encrypted file can be decrypted through the recorded secret key without paying money to the lasso software, so that the defense of the lasso software is realized, and the loss caused by the lasso software is avoided.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a flowchart of an attack defense method provided in this embodiment;

fig. 2 is a block diagram of an attack defense apparatus according to this embodiment.

Detailed Description

The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

It should be noted that, in the case of no conflict, the features in the following embodiments and examples may be combined with each other; moreover, all other embodiments that can be derived by one of ordinary skill in the art from the embodiments disclosed herein without making any creative effort fall within the scope of the present disclosure.

It is noted that various aspects of the embodiments are described below within the scope of the appended claims. It should be apparent that the aspects described herein may be embodied in a wide variety of forms and that any specific structure and/or function described herein is merely illustrative. Based on the disclosure, one skilled in the art should appreciate that one aspect described herein may be implemented independently of any other aspects and that two or more of these aspects may be combined in various ways. For example, an apparatus may be implemented and/or a method practiced using any number of the aspects set forth herein. Additionally, such an apparatus may be implemented and/or such a method may be practiced using other structure and/or functionality in addition to one or more of the aspects set forth herein.

Referring to fig. 1, in an aspect of the present application, an attack defense method is provided, which is applied to an electronic device. The electronic equipment can be common electronic equipment such as a mobile phone, a computer, a notebook computer, a server or a tablet computer.

The method comprises the following steps:

s100, acquiring each key use function in the electronic equipment. The key usage function is capable of being called by a program within the electronic device to encrypt files within the electronic device using a key. Specifically, the key-using function is used to encrypt a file using a key input by a program in response to a call by the program.

Wherein the key usage function may be a function/code for key usage within a dll of the operating system. The confirmation of the key using function can be confirmed through a preset function name list, wherein the function name list records the function name of each key using function, such as CryptoEncrypt function, in self-contained dll in the operating system. In this way, the key-using function can be confirmed from the dll through the list of function names. In this embodiment, there may be a plurality of key-using functions, and in this case, step S200 is performed for each key-using function.

And S200, adding a preset code in each key using function. The preset code can be triggered to execute when the key using function where the preset code is located is called, so as to record the key used by the key using function.

After the preset code is added into the key using function, the preset code can be triggered to be executed together with the original code in the key using function when the key using function is called. And its start execution time is affected by its position in the key usage function.

The attack defense method provided by the embodiment adds a preset code in a key use function used for key use in the electronic device. When the key using function is called, the preset code in the key using function can be executed, and when the preset code is executed, the key generated by the key using function can be recorded. Therefore, even if the file in the electronic equipment is encrypted by the lasso software, the encrypted file can be decrypted through the recorded secret key without paying money to the lasso software, so that the defense of the lasso software is realized, and the loss caused by the lasso software is avoided.

Meanwhile, compared with the technical scheme that the key using function is directly monitored, when the key using function is monitored to be called, the related key is obtained through other functions or programs, in the embodiment, a thread or process for monitoring the key using function does not need to be set in real time, and long-term occupation of resources in the electronic equipment in a normal state is avoided. Meanwhile, if the key use function is monitored, the key use function can be easily found by the lasso software. In the embodiment, since the code in the key using function is modified, the lasso software generally only finds and calls the key using function through the function name, and it is difficult to find that the code in the key using function is modified. Therefore, the attack defense method provided by the embodiment is superior to the technical scheme of monitoring the key use function in the aspect of concealment.

a preset code is added to the function entry of each key usage function.

The preset code is used for executing the following steps:

acquiring an encryption key received by the key using function;

and storing the encryption key in a preset storage space.

The function entry may be an api that needs to be triggered by the function for calling the key, or a location after receiving the instruction. And adding a preset code at a function inlet of each key use function, so that the encryption key input by the program can be obtained and stored in a preset storage space, and recording of the encryption key is realized.

acquiring the file name of a target file to be encrypted by the encryption key;

and storing the file name in a preset storage space.

When the key using function is called, the encryption key, the file name of the target file, and the storage path of the target file need to be input to the key using function so that the key using function encrypts the target file with the encryption key. In this embodiment, the preset code is further configured to obtain a file name of the target file when executed, and store the file name in the preset storage space. So that it can be quickly determined which files are encrypted by each stored key by presetting the contents stored in the storage space. After the files are found to be encrypted by the lasso software, the key used by each encrypted file can be quickly determined, and the decryption efficiency is improved.

establishing an association relation between the recording document and the encryption key; the recording document is used for recording an encryption key having an association relation with the recording document and a file name of a target file encrypted by using the encryption key. The association relationship may be established by associating the documents, recording the correspondence between each key and the corresponding recording document, or directly modifying the file name of the recording document to the file name of the corresponding key (the recording document and the key may exist simultaneously due to different suffixes of the file names).

That is, each time a new encryption key is received in the preset storage space, a corresponding record document is established for the preset storage space, so that a user can determine which files are encrypted by each key in the storage space by looking up the record document.

and determining whether a recording document corresponding to the encryption key exists in the preset storage space.

And if so, adding the file name corresponding to the encryption key into the record document.

In this embodiment, after the preset storage space receives the encryption key sent by the key use function, it is determined whether the preset storage space already has a record document corresponding to the key to be stored, that is, it is determined whether the same key has been received before, and only if not, the corresponding record document is generated and the key is stored. Therefore, repeated storage of the key and repeated establishment of the record document are avoided, and the storage space is saved.

and if the updating times of any recording document in the preset storage space in a preset time length exceed a set threshold, outputting prompt information and/or preventing the key using function from being continuously called. The preset time length is 1 minute to 10 minutes, in this embodiment, the preset time length is 2 minutes, and the threshold is set to 50 times. The prompt is used to inform the user that it is currently probable that the lasso software is encrypting the file.

And if the updating times of any recording document in the preset storage space in the preset time length exceed a set threshold, determining that the same key is used for multiple times in a short time. Under the general condition, a user can encrypt a large number of files by using the same secret key in a short time, so that the situation that the files are encrypted by lasso software mostly occurs, and at the moment, prompt information is output, so that the user can know the situation in time. Meanwhile, the key is prevented from being continuously called by using the function, so that excessive files can be prevented from being encrypted by the Lesoh software, and the processing amount of subsequent decryption processing is reduced.

In an exemplary embodiment of the present application, the record document is also used to record a file storage path of each target file.

The attack defense method provided by the embodiment further comprises the following steps:

and after any recorded document is updated, determining all files of the storage space corresponding to the file storage path, which are the same as the file type of the target file, as first files according to the file storage path received by the current update.

If the file name of each first file is added to the current record document within the set time, outputting prompt information and/or preventing the key use function from being continuously called.

Generally, a user can encrypt all files in the same storage path by using the same key in a short time, so that the situation that the file is encrypted by using the lasso software mostly occurs, and at the moment, prompt information is output, so that the user can know the situation even if the situation occurs. Meanwhile, the key is prevented from being continuously called by using the function, so that excessive files can be prevented from being encrypted by the lasso software, and the processing amount of subsequent decryption processing is reduced.

Further, the determining that all files in the storage space corresponding to the file storage path, which have the same file type as the target file, are the first file includes

Determining a superior storage path corresponding to the file storage path as a target path;

and determining all files with the same file type as the target file in the storage space corresponding to the target path as first files.

The upper path is a storage path of the upper storage space of the storage space corresponding to the file storage path. For example, if the file storage path is "C: \ Windows \ Boot \ Misc \ PCAT", the target path is "C: \ Windows \ Boot \ Misc".

In some cases, when there are few files in a folder, the user may encrypt each file according to his/her normal requirement. Therefore, in order to avoid the false prompt or the false call prevention under the circumstance, in the embodiment, when the first file is determined, the upper storage path corresponding to the file storage path is determined as the target path, and all files in the storage space corresponding to the target path, which are the same as the file type of the target file, are determined as the first file, so that the number of the determined first files can be increased. And the lasso software typically encrypts the files of the full disk separately. Therefore, in the embodiment, the behavior of the Lesojou software can be recognized more accurately, the error recognition rate of the normal behavior of the user is reduced, and the overall accuracy is improved.

a second preset code is added to each key generation function.

And the second preset code is used for recording the key generated by the key generation function when executed.

Correspondingly, if the preset storage space receives the generated key returned by the key generation function, a record document corresponding to the generated key is established.

And establishing an association relation between the record document and the generated key.

Since the keys sent to the preset storage space by the key generation function are all newly generated keys, the same key does not exist in the preset storage space by default, and the corresponding record document is directly stored and established for the key. The judgment step of judging whether the same key exists is saved, and the processing efficiency is improved.

Referring to fig. 2, in another aspect of the present application, an attack defense apparatus is provided, which is applied to an electronic device, and includes:

the acquisition module is used for acquiring each key use function in the electronic equipment; the key usage function is capable of being called by a program within the electronic device to encrypt files within the electronic device using a key;

Moreover, although the steps of the methods of the present disclosure are depicted in the drawings in a particular order, this does not require or imply that the steps must be performed in this particular order, or that all of the depicted steps must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken into multiple step executions, etc.

Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

As will be appreciated by one skilled in the art, aspects of the present application may be embodied as a system, method or program product. Accordingly, various aspects of the present application may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.

An electronic device according to this embodiment of the present application. The electronic device is only an example, and should not bring any limitation to the function and the scope of use of the embodiments of the present application.

The electronic device is in the form of a general purpose computing device. Components of the electronic device may include, but are not limited to: the at least one processor, the at least one memory, and a bus connecting the various system components (including the memory and the processor).

Wherein the storage stores program code executable by the processor to cause the processor to perform steps according to various exemplary embodiments of the present application described in the "exemplary methods" section above.

The memory may include readable media in the form of volatile memory, such as Random Access Memory (RAM) and/or cache memory, and may further include read-only memory (ROM).

The storage may also include a program/utility having a set (at least one) of program modules including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may comprise an implementation of a network environment.

The bus may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

The electronic device may also communicate with one or more external devices (e.g., keyboard, pointing device, bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic device, and/or with any devices (e.g., router, modem, etc.) that enable the electronic device to communicate with one or more other computing devices. Such communication may be through an input/output (I/O) interface. Also, the electronic device may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the internet) through a network adapter. The network adapter communicates with other modules of the electronic device over the bus. It should be understood that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, and may also be implemented by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium having stored thereon a program product capable of implementing the above-described method of the present specification. In some possible embodiments, various aspects of the present application may also be implemented in the form of a program product comprising program code for causing a terminal device to perform the steps according to various exemplary embodiments of the present application described in the "exemplary methods" section above of this specification, when the program product is run on the terminal device.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

A computer readable signal medium may include a propagated data signal with readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out operations of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server. In situations involving remote computing devices, the remote computing devices may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to external computing devices (e.g., through the internet using an internet service provider).

Furthermore, the above-described figures are merely schematic illustrations of processes involved in methods according to exemplary embodiments of the present application, and are not intended to be limiting. It will be readily understood that the processes shown in the above figures are not intended to indicate or limit the chronological order of the processes. In addition, it is also readily understood that these processes may be performed, for example, synchronously or asynchronously in multiple modules.

It should be noted that although in the above detailed description several modules or units of the device for action execution are mentioned, such a division is not mandatory. Indeed, the features and functions of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units.

The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present application should be covered within the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. An attack defense method applied to an electronic device, the method comprising:

adding a preset code in each key use function; the preset code can be triggered to execute when the key using function where the preset code is located is called, so as to record the key used by the key using function.

2. The attack defense method according to claim 1, wherein the adding of the preset code within each key usage function comprises:

a preset code is added to the function entry of each key usage function.

3. The attack defense method according to claim 1, characterized in that the preset code is used for executing the following steps:

acquiring an encryption key received by the key using function;

and storing the encryption key in a preset storage space.

4. The attack defense method according to claim 3, characterized in that the preset code is further configured to perform the following steps:

acquiring the file name of a target file to be encrypted by the encryption key;

and storing the file name in a preset storage space.

5. The attack defense method according to claim 4, characterized in that the method further comprises:

6. The attack defense method according to claim 5, wherein if the preset storage space receives the encryption key returned by the key usage function, the establishing of the record document corresponding to the encryption key comprises:

7. The attack defense method according to claim 6, further comprising:

8. An attack defense apparatus applied to an electronic device, comprising:

9. An electronic device comprising a processor and a memory;

the processor is adapted to perform the steps of the method of any one of claims 1 to 7 by calling a program or instructions stored in the memory.

10. A non-transitory computer readable storage medium storing a program or instructions for causing a computer to perform the steps of the method of any one of claims 1 to 7.